CVE-2026-27015: 
NixOS vulnerability analysis and mitigation

CVE-2026-27015 is a denial-of-service vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, caused by a missing bounds check in the smartcard_unpack_read_size_align() function (libfreerdp/utils/smartcard_pack.c:1703). A malicious RDP server can exploit this to crash the FreeRDP client via a reachable WINPR_ASSERT → abort(). All FreeRDP versions prior to 3.23.0 are affected; version 3.23.0 contains the fix. The vulnerability was disclosed on February 25, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (FreeRDP Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-617 (Reachable Assertion). The function smartcard_unpack_read_size_align() computes NDR alignment padding and calls Stream_Seek(s, pad) without first verifying that sufficient bytes remain in the stream. Stream_Seek() enforces the bounds check only via WINPR_ASSERT, which in upstream builds with WITH_VERBOSE_WINPR_ASSERT=ON (the default in FreeRDP 3.22.0) calls winpr_int_assert() — a WINPR_NORETURN function that logs a backtrace and terminates via abort(). This behavior is not removed by -DNDEBUG. Exploitation requires the client to have smartcard redirection explicitly enabled (/smartcard or /smartcard-logon) and to connect to a malicious RDP server; no server-side authentication is needed. Three call sites are reachable: smartcard_ndr_read_ex() (line 202), and two locations in smartcard_unpack_transmit_call() (lines 3088 and 3175), where return values were previously unchecked (FreeRDP Advisory, Fix Commit).

Successful exploitation results in a remote client-side denial of service: the FreeRDP client terminates immediately via abort() upon processing a single crafted IOCTL in the smartcard virtual channel, dropping the remote desktop session. There is no confidentiality or integrity impact — no out-of-bounds read occurs, and control-flow hijack is not possible. Enterprise environments using smartcard-based authentication (e.g., /smartcard-logon) are most exposed, as this feature implies smartcard redirection is active (FreeRDP Advisory).

A proof-of-concept Python script and a C harness are publicly available in the FreeRDP security advisory, demonstrating how to craft a minimal SCARD_IOCTL_TRANSMIT packet that triggers the abort. The EPSS score is approximately 0.042%, indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The CVSSv4 exploit maturity is rated as PROOF_OF_CONCEPT (FreeRDP Advisory).

1. Reconnaissance: Identify FreeRDP clients (version ≤ 3.22.0) in the target environment that connect to RDP servers with smartcard redirection enabled (/smartcard or /smartcard-logon flags).
2. Set up a malicious RDP server: Deploy a rogue RDP server that the target client will connect to (e.g., via phishing, DNS spoofing, or a man-in-the-middle position).
3. Craft the malicious packet: Using the published PoC Python script, generate a crafted SCARD_IOCTL_TRANSMIT (IOCTL code 0x000900D0) packet where ioSendPci.cbExtraBytes is not a multiple of 4 (e.g., 1, 3, 5, or 7), and the stream is truncated immediately after the pbExtraBytes data with no trailing alignment padding.
4. Deliver the payload: When the FreeRDP client connects with smartcard redirection active, send the crafted IOCTL over the RDPDR virtual channel.
5. Trigger the crash: The client's smartcard_unpack_read_size_align() computes a non-zero padding value and calls Stream_Seek(), which fails the WINPR_ASSERT bounds check, causing abort() and immediate client termination (FreeRDP Advisory).

• Process: Unexpected termination of the xfreerdp or freerdp client process with a non-zero exit code; presence of abort() or SIGABRT in crash logs or core dumps.
• Logs: FreeRDP log entries containing [FATAL][com.freerdp.winpr.assert] and winpr_int_assert with a backtrace referencing smartcard_unpack_transmit_call or smartcard_ndr_read_ex in smartcard_pack.c.
• Network: Unexpected or repeated RDP session drops from clients with smartcard redirection enabled; inbound RDPDR virtual channel traffic containing SCARD_IOCTL_TRANSMIT (IOCTL 0x000900D0) packets with non-4-byte-aligned cbExtraBytes values and truncated streams (FreeRDP Advisory).

Upgrade FreeRDP to version 3.23.0, which replaces the unsafe Stream_Seek() call with Stream_SafeSeek() and propagates parsing errors at all three affected call sites (Fix Commit). As an interim workaround, disable smartcard redirection unless explicitly required — do not use /smartcard or /smartcard-logon when connecting to untrusted RDP servers. An alternative build-time mitigation is to compile with -DWITH_VERBOSE_WINPR_ASSERT=OFF -DNDEBUG, which maps WINPR_ASSERT to standard assert() (stripped in release builds), preventing the abort — though this does not fix the underlying missing bounds check (FreeRDP Advisory).

The vulnerability was reported by researcher ppcavalcante and published by FreeRDP maintainer akallabeth on February 25, 2026. Red Hat tracked it via Bugzilla (Bug 2442748) and rated it medium severity. Downstream Linux distributions including Ubuntu, SUSE/openSUSE, Amazon Linux 2, and Debian have issued security advisories and updated packages. No significant broader media coverage or social media discussion has been identified beyond standard vulnerability tracking channels (Red Hat Bugzilla, FreeRDP Advisory).